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What is claimed is: 

1 . A method for a proxy to transparently provide access to resources of a 
resource manager, comprising: 

receiving from the client a resource locator for retrieving a resource of the 
5 resource manager, wherein the resource locator comprises a network address of the 
resource manager and the resource locator is at least partially obscured to hide the 
network address; 

validating client authorization to access the resource; 
^ de-obscuring the resource locator; 

1i) retrieving the resource from the resource manager according to the de-obscured 

01 

l~ resource locator; and 

■a - s 

s providing the resource to the client such that it appears to have originated from 

^ the proxy. 

* T5 2. The method of claim 1 , wherein the proxy comprises a front end manager 

and a back end manager, the method further comprising: 

receiving a first proxy header corresponding to the request, the first proxy header 

identifying the client as the source of the request and the front end manager as the 

source of the resource; and 
20 preparing a second proxy header by rewriting the first proxy header so as to 

substitute the back end manager for the client, and the resource manager for the front 

end manager; 
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wherein retrieving the resource from the resource manager comprises the back 
end manager providing the second proxy header to the resource manager. 

3. The method of claim 1 , further comprising: 
5 receiving a first proxy header corresponding to the request, the first proxy header 

identifying the client as the source of the request and the proxy as the source of the 
resource; and 

preparing a second proxy header by rewriting the first proxy header so as to 
w substitute the proxy for the client, and the resource manager for the proxy; 
% wherein retrieving the resource from the resource manager comprises providing 

the second proxy header to the resource manager. 

za. ™« 

L I ; 
si 

\| 4. The method of claim 3, further comprising: 

Fii receiving a third proxy header from the resource manager, the third proxy header 

Hs identifying the resource manager as the source of the resource, and the proxy as the 

recipient of the resource; and 

preparing a fourth proxy header by rewriting the third proxy header so as to 

substitute the proxy as the source of the resource, and the client as the recipient of the 

resource; 

20 wherein providing the resource to the client comprises providing the fourth proxy 

header to the client. 
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5. The method of claim 3, wherein proxy headers are written according to a 
tag based protocol. 

6. The method of claim 5, wherein the tag based protocol is a selected one 
of: the HyperText Transport Protocol (HTTP), the HyperText Markup Language (HTML), 
and the extensible Markup Language (XML). 

7. The method of claim 3, wherein the first proxy header comprises a content 
type identifier identifying a desired format for the resource, and wherein the resource 
manager stores the resource in a second format different from the desired format, the 
method further comprising: 

converting the resource from the second format to the first format. 

8. The method of claim 1 , further comprising: 

receiving a content type identifier from the client identifying a desired format in 
which to provide the resource to the client; and 

converting the resource from a different format utilized by the resource manager 
into the desired format. 

9. The method of claim 1 , wherein the network comprises multiple resource 
managers providing access to the resource, the method further comprising: 

retrieving portions of the resource from selected ones of the multiple resource 
managers. 
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10. The method of claim 9, wherein the portions are retrieved in parallel from 
the selected ones of the multiple resource managers. 

1 1 . The method of claim 10, further comprising: 
determining loads for the multiple resource managers; and 
selecting among the multiple resource managers according to the loads. 

12. The method of claim 1 1 , wherein the portions are non-overlapping 
portions of the resource. 

13. The method of claim 1 , further comprising: 

the resource locator comprising a Uniform Resource Locator (URL); and 
inspecting the URL for a path component indicating the URL comprises the at 
least partially obscured portion. 

14. The method of claim 1 , wherein de-obscuring the resource locator 
comprises providing at least the obscured portion of the resource locator to a location 
manager, and receiving a de-obscured identifier responsive thereto. 

15. The method of claim 14, wherein the location manager performs the 
validating client authorization to access the resource. 
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1 6. The method of claim 1 , wherein validating client authorization to access 
the resource comprises providing the at least partially obscured portion of the resource 
locator, and an identity identifier for the client to an authorization manager. 

5 1 7. The method of claim 1 , wherein validating client authorization to access 

the resource comprises: 

hash-encoding an identity value associated with the client; and 
providing the hash-encoded identity value and at least a portion of the resource 
1% locator to an authorization manager configured to look up the hash-encoded identity 
1© value and the at least a portion of the resource locator in an access control table. 

^ 1 8. The method of claim 1 , wherein the client communicates with the proxy by 

.7 way of an Internet browser. 

'15 19. The method of claim 1 , wherein the proxy comprises a front end manager 

and a back end manager, wherein the client only communicates with the front end 
manager for obtaining the resource, and wherein the back end manager obtains the 
resource from the resource manager. 

20 20. A system, comprising: 

a network communicatively coupling a client, a resource manager providing 
access to its resources, and a proxy comprising a front end manager and a back end 
manager, wherein the proxy is configured to perform a method comprising: 
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receiving from the client a resource locator for retrieving a resource of the 
resource manager, wherein the resource locator comprises a network address of the 
resource manager and the resource locator is at least partially obscured to hide the 
network address; 

validating client authorization to access the resource; 

de-obscuring the resource locator; 

retrieving the resource from the resource manager according to the de-obscured 
resource locator; and 

providing the resource to the client such that it appears to have originated from 
the proxy. 

21 . The system of claim 20, wherein the proxy is further configured to perform: 
receiving a first proxy header corresponding to the request, the first proxy header 

identifying the client as the source of the request and the proxy as the source of the 
resource; and 

preparing a second proxy header by rewriting the first proxy header so as to 
substitute the proxy for the client, and the resource manager for the proxy; 

wherein retrieving the resource from the resource manager comprises providing 
the second proxy header to the resource manager. 

22. The system of claim 21 , wherein the proxy is further configured to perform: 
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receiving a third proxy header from the resource manager, the third proxy header 
identifying the resource manager as the source of the resource, and the proxy as the 
recipient of the resource; and 

preparing a fourth proxy header by rewriting the third proxy header so as to 
substitute the proxy as the source of the resource, and the client as the recipient of the 
resource; 

wherein providing the resource to the client comprises providing the fourth proxy 
header to the client. 

23. The system of claim 20, wherein the resource locator comprises a Uniform 
Resource Locator (URL), and wherein the proxy is further configured to perform: 

inspecting the URL for a path component indicating the URL comprises the at 
least partially obscured portion. 

24. The system of claim 20, wherein validating client authorization to access 
the resource comprises: 

hash-encoding an identity value associated with the client; and 
providing the hash-encoded identity value and at least a portion of the resource 
locator to an authorization manager configured to look up the hash-encoded identity 
value and the at least a portion of the resource locator in an access control table. 

25. The system of claim 20, wherein the client communicates with the proxy 
by way of an Internet browser. 
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26. A machine accessible medium having instructions encoded thereon, which 
when executed by at least one processor, are capable of directing the at least one 
processor to perform: 

receiving from a client a resource locator for retrieving a resource of a resource 
manager, wherein the resource locator comprises a network address of the resource 
manager and the resource locator is at least partially obscured to hide the network 
address; 

validating client authorization to access the resource; 
de-obscuring the resource locator; 

retrieving the resource from the resource manager according to the de-obscured 
resource locator; and 

providing the resource to the client such that it appears to have originated from 
the proxy. 

27. The medium of claim 26, wherein the proxy comprises a front end 
manager and a back end manager, and wherein the instructions comprise further 
instructions capable of directing the at least one processor to perform: 

receiving a first proxy header corresponding to the request, the first proxy header 
identifying the client as the source of the request and the front end manager as the 
source of the resource; and 
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preparing a second proxy header by rewriting the first proxy header so as to 
substitute the back end manager for the client, and the resource manager for the front 
end manager; 

wherein retrieving the resource from the resource manager comprises the back 
end manager providing the second proxy header to the resource manager. 

28. The medium of claim 26, wherein the instructions comprise further 
instructions capable of directing the at least one processor to perform: 

receiving a first proxy header corresponding to the request, the first proxy header 
identifying the client as the source of the request and the proxy as the source of the 
resource; and 

preparing a second proxy header by rewriting the first proxy header so as to 
substitute the proxy for the client, and the resource manager for the proxy; 

wherein retrieving the resource from the resource manager comprises providing 
the second proxy header to the resource manager. 

29. The medium of claim 28, wherein the instructions comprise further 
instructions capable of directing the at least one processor to perform: 

receiving a third proxy header from the resource manager, the third proxy header 
identifying the resource manager as the source of the resource, and the proxy as the 
recipient of the resource; 
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preparing a fourth proxy header by rewriting the third proxy header so as to 
substitute the proxy as the source of the resource, and the client as the recipient of the 
resource; and 

wherein providing the resource to the client comprises providing the fourth proxy 
header to the client. 

30. The medium of claim 28, wherein proxy headers are written according to a 
tag based protocol. 

31 . The medium of claim 30, wherein the tag based protocol is a selected one 
of: the HyperText Transport Protocol (HTTP), the HyperText Markup Language (HTML), 
and the extensible Markup Language (XML). 

32. The medium of claim 28, wherein the first proxy header comprises a 
content type identifier identifying a desired format for the resource, and wherein the 
resource manager stores the resource in a second format different from the desired 
format, wherein the instructions comprise further instructions capable of directing the at 
least one processor to perform: 

converting the resource from the second format to the first format. 

33. The medium of claim 26, wherein the instructions comprise further 
instructions capable of directing the at least one processor to perform: 
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receiving a content type identifier from the client identifying a desired format in 
which to provide the resource to the client; and 

converting the resource from a different format utilized by the resource manager 
into the desired format. 

5 

34. The medium of claim 26, wherein the network comprises multiple resource 
managers providing access to the resource, and wherein the instructions comprise 
O further instructions capable of directing the at least one processor to perform: 
^ retrieving portions of the resource from selected ones of the multiple resource 

jtt) managers. 

p 35. The medium of claim 34, wherein the portions are retrieved in parallel from 

I s * the selected ones of the multiple resource managers. 

1 5 36. The medium of claim 35, wherein the instructions comprise further 

instructions capable of directing the at least one processor to perform: 
determining loads for the multiple resource managers; and 
selecting among the multiple resource managers according to the loads. 

20 37. The medium of claim 36, wherein the portions are non-overlapping 

portions of the resource. 
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38. The medium of claim 26, wherein the instructions comprise further 
instructions capable of directing the at least one processor to perform: 

the resource locator comprising a Uniform Resource Locator (URL); and 
inspecting the URL for a path component indicating the URL comprises the at 
least partially obscured portion. 

39. The medium of claim 26, wherein the instructions for validating client 
authorization to access the resource comprise instructions capable of directing the at 
least one processor to perform: 

hash-encoding an identity value associated with the client; and 
providing the hash-encoded identity value and at least a portion of the resource 
locator to an authorization manager configured to look up the hash-encoded identity 
value and the at least a portion of the resource locator in an access control table. 

40. The medium of claim 1 , wherein the client communicates with the proxy by 
way of an Internet browser. 
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